chore(docker): ship extra_hosts so vector memory works zero-config

Adding `host.docker.internal:host-gateway` to the bot service in
docker-compose.yml means an Ollama (or any other host-side embedding
provider) just works after the user fills EMBEDDING_BASE_URL — no
docker-compose edit + recreate dance. The mapping is harmless when
not in use (just a /etc/hosts entry inside the container).

docs/VECTOR_MEMORY.md drops the manual compose tweak step and gains a
clearer Ollama systemd override snippet (OLLAMA_HOST=0.0.0.0:11434),
plus a security callout to firewall the port from the public internet.

README's "no host.docker.internal" line is now wrong and is replaced
with the actual behaviour.

Requires Docker 20.10+ (released Dec 2020) for host-gateway.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JohanYP

README.md

@@ -111,7 +111,7 @@ Beyond the basic scheduled tasks, three cron types are supported via `memory/cro
 An interactive `setup.sh` script guides you through the full configuration in 10 steps — no manual `.env` editing needed.
 
 ### Single Install Path: Docker
-Everything runs in Docker — bot and OpenCode together. Updates are a one-liner: `git pull && docker compose up -d --build`. No systemd, no launchd, no `host.docker.internal`.
+Everything runs in Docker — bot and OpenCode together. Updates are a one-liner: `git pull && docker compose up -d --build`. No systemd, no launchd, no manual networking. The bot can also reach optional services on the host (e.g. Ollama for vector memory) via `host.docker.internal` out of the box.
 
 ---
 

docker-compose.yml

@@ -23,6 +23,12 @@ services:
       - ./memory:/app/memory
       - bot-data:/app/data
     env_file: .env
+    # Lets the bot reach services running on the VPS host (e.g. an
+    # Ollama install for the optional vector memory). Harmless when
+    # unused — it only adds a /etc/hosts alias inside the container.
+    # Requires Docker 20.10+ (released 2020-12).
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     # MCP HTTP server is exposed only on the compose network (no host port
     # mapping). OpenCode reaches it at http://bot:4097/mcp.
     expose:

docs/VECTOR_MEMORY.md

@@ -24,39 +24,73 @@ substring matching. Everything else works the same.
    (fire-and-forget). If the provider is down, the fact is still saved;
    re-embed it later with `/memory_reembed`.
 
-## Setup A — Ollama (local, no API key)
+## Setup A — Ollama on the host (recommended, no API key)
 
 Best for self-hosted setups. Embeddings never leave your machine.
+The `docker-compose.yml` already maps `host.docker.internal` to your
+host, so the bot inside Docker can reach Ollama out of the box —
+**you don't need to edit the compose file**.
+
+### 1. Install Ollama on the host (VPS / your machine)
 
 ```bash
-# 1. Install Ollama (https://ollama.com)
 curl -fsSL https://ollama.com/install.sh | sh
+```
 
-# 2. Pull a small embedding model (~270 MB, runs on CPU)
-ollama pull nomic-embed-text
+Linux distributions register it as a systemd service automatically.
+
+### 2. Make Ollama listen on all interfaces (so Docker can reach it)
+
+By default Ollama binds to `127.0.0.1`, which is unreachable from
+inside containers. Bind it to `0.0.0.0`:
+
+```bash
+sudo systemctl edit ollama
+```
+
+In the editor that opens, paste:
+
+```ini
+[Service]
+Environment="OLLAMA_HOST=0.0.0.0:11434"
+```
+
+Then reload and restart:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl restart ollama
+```
 
-# 3. Make sure Ollama is reachable from inside the bot container.
-#    On Linux Docker hosts, `host.docker.internal` works since Docker 20.10
-#    when the compose file has `extra_hosts: ["host.docker.internal:host-gateway"]`
-#    (already configured in our docker-compose.yml).
-ollama serve   # listens on :11434 by default
+> **Security note:** `0.0.0.0` opens the port on every interface. If
+> your VPS is exposed to the internet, block public access:
+> `sudo ufw deny 11434/tcp` (or the firewalld equivalent). Docker
+> still reaches it locally because containers share the host kernel.
+
+### 3. Pull the embedding model (~270 MB, runs on CPU)
+
+```bash
+ollama pull nomic-embed-text
 ```
 
-Then in `.env`:
+### 4. Tell the bot about it
+
+In `.env`:
 
 ```env
 EMBEDDING_BASE_URL=http://host.docker.internal:11434/v1
 EMBEDDING_MODEL=nomic-embed-text
 EMBEDDING_API_KEY=
 ```
 
-Restart the bot:
+### 5. Restart and validate
 
 ```bash
 docker compose restart bot
+docker compose logs bot 2>&1 | grep -i embedding
 ```
 
-In the bot logs you should see:
+You should see:
 
 ```
 [Memory/Embedding] Driver enabled (model=nomic-embed-text, base=http://host.docker.internal:11434/v1, dims≈768)